HighGHSA-6663-c963-2gqgCVE-2016-10542
DoS due to excessively large websocket message in ws
Published 18 Feb 2019 · Updated 8 Nov 2023
Affected package
wsnpm
- Affected
- <1.1.1
- Fixed in
- 1.1.1
Update to the fixed version for your release line, for example:
npm install ws@1.1.1Details
Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.
Recommendation
Update to version 1.1.1 or later.
Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.
Is GHSA-6663-c963-2gqg in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected ws, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.